Christophe Tafani-Dereeper

Welcome to everyone joining Bluesky! 👋 I'm working as a cloud security researcher at Datadog and I write about cloud security, container security and related open-source projects. Personal blog: blog.christophetd.fr OSS work: github.com/christophetd/ Talks: christophetd.fr#:~:text=Wind...

Had lots of fun finding this vulnerability and writing an (hopefully) educational write-up!

Interesting backdoor in an npm package. Analyzing the timezone in git commit metadata shows this is likely a compromised maintainer account

Happy to have contributed to that release!

Behind the console: An AiTM phishing kit harvesting AWS console credentials and beyond securitylabs.datadoghq.com/articles/beh...

My Claude credits today, seeing me try Fable 5

github.com/jqwik-team/j... 🤔

Freshly out on the Datadog Engineering blog! From single pull requests to full software packages: Detecting malicious code at scale www.datadoghq.com/blog/enginee...

I wrote up an analysis of the Axios compromise: securitylabs.datadoghq.com/articles/axi... Crazy how while researchers were filing issues to report the compromise, the attacker was deleting them in real time using the maintainer's GitHub access!

Yesterday, a threat actor compromised 2 versions of the LiteLLM Python package (40k stars, 3M+ weekly downloads). The malicious versions had 120k downloads before being taken down Full write-up: securitylabs.datadoghq.com/articles/lit... Timeline (h/t @ramimac.me): ramimac.me/trivy-teampcp/

When an AI agent came knocking: Catching malicious contributions in Datadog’s open source repos www.datadoghq.com/blog/enginee...

Fresh and active AWS phishing campaign with 3 main domains: cloud-recovery[.]us cloud-recovery[.]net aws[.]cloud-recovery[.]us ... with hands-on-keyboard activity 20 minutes after credentials are submitted

#Podcast #Cybersécurité Épisode #534 consacré au ver "Shai-Hulud", avec @christophetd.fr www.nolimitsecu.fr/shai-hulud/

I asked Claude (Opus 4.6) and Codex (GPT-5.3) to each generate a simple LinkedList implementation in Java. Then I asked Claude to pick the better one. No hesitation: "The Codex version is better" 🤔 gist.github.com/christophetd...

If you're using VSCode or Cursor, this is a pretty solid extension to have in your toolbox!

Decoding the GitHub recommendations for npm maintainers securitylabs.datadoghq.com/articles/dec... by @phrawzty.com

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users securitylabs.datadoghq.com/articles/inv...

CVE-2025-55182 (React2Shell): Remote code execution in React Server Components and Next.js securitylabs.datadoghq.com/articles/cve...

"Building an npm worm" (2016) contolini.com/building-an-...

A few days ago, a new piece of malware started spreading in npm, compromising and backdooring hundreds of legitimate npm packages and GitHub users. Read the analysis from our security research team: securitylabs.datadoghq.com/articles/sha...

If you're in cloud security, do have a look at this piece of research I've been working on! Feedback / thoughts welcome

The EU is advancing legislation requiring all messaging platforms to scan private messages, even in encrypted apps like Signal/WhatsApp/Telegram. 600+ security researchers oppose ChatControl for being technically flawed. Learn more about it 👉 metalhearf.fr/posts/chatco... #ChatControl #privacy

If you're into cloud security, fwd:cloudsec Europe is now live. Schedule: fwdcloudsec.org/conference/e...

I did a bit more looking into the upcoming bitnami deprecation. The images are still getting millions of pulls a week, so depending on exactly what tags vanish next week, there could be a lot of broken deploys on the 28th! raesene.github.io/blog/2025/08...

@micahflee.com thank you for the amazing and inspiring defcon talk

I arbitrarily picked a list of 50 talks I'm most excited about that are happening next week at DEF CON / Black Hat / BSides LV / The Diana Initiative. I'll also add recordings/slides to this list when they become available!

Getting ready for DEF CON next week! ✅ Slides ✅ Demos ✅ Custom shirt designed for the occasion

Stratus Red Team AWS attack techniques are now mapped to the Threat Technique Catalog for AWS Stratus Red Team AWS attack techniques: stratus-red-team.cloud/attack-techn... Threat Technique Catalog by AWS: aws-samples.github.io/threat-techn...

The MCP spec has been updated to include security best practices • Confused deputy • Token passthrough • Session hijacking modelcontextprotocol.io/specificatio...

Solid way to start the week

👀

Ticket sales for fwd:cloudsec Europe 2025 goes live on April 22nd, first batch at 9 AM CET and a second batch at 7PM CET. Tickets are sold through Swoogo, link at fwdcloudsec.org/conference/e... ..

My story breaking this news exclusively was 7K+ words and had almost all of this in it, and more: www.npr.org/2025/04/15/n...

The March edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... • New MITRE ATT&CK coverage matrix in Stratus Red Team • Compromised GitHub actions • Malicious Maven packages • Exploitation of SSRF vulnerabilities on the rise • ... and more

Looking forward to it! ☁️🇪🇺🇩🇪

By making minor changes to command-line arguments, it is possible to bypass EDR/AV detections. My research, comprising ~70 Windows executables, found that all of them were vulnerable to this, to varying degrees. Here’s what I found and why it matters 👉 wietze.github.io/blog/bypassi...

The February edition of the Datadog Security Digest is out! securitylabs.datadoghq.com/newsletters/... featuring @sethsec.bsky.social, @mccune.org.uk, @karimscloud.bsky.social, @jcfarris.bsky.social, and more

Regular tickets sold out quickly, but Personal Supporter tickets are still available! Speakers get a ticket, so consider submitting a talk idea to the CFP. Closes April 11. Scholarship is open: fwdcloudsec.org/conference/n...

Si vous êtes sur Paris et avez de l'expérience avec la sécurité de la chaîne d'approvisionement logicielle (supply chain security), Datadog a un poste dans mon équipe qui devrait vous intéresser ! careers.datadoghq.com/detail/66012... N'hésitez pas à me DM si vous avez des questions.

@anssi-fr.bsky.social Il serait bien d'utiliser votre nom de domaine officiel comme nom d'utilisateur Bluesky (bsky.social/about/blog/4...), autrement il est impossible de savoir s'il s'agit d'un compte légitime Idem pour @cert-fr.bsky.social

L'ANSSI vient de sortir un rapport sur la menace dans les environnements cloud, en Français : www.cert.ssi.gouv.fr/uploads/CERT... Au programme : • Menaces ciblant les fournisseurs • Menaces ciblant les utilisateurs finaux • L'usage que les attaquants font du cloud @anssi-fr.bsky.social

A refreshing perspective. Anyone has good resources on Western APTs? I remember reading from a French group that's likely state-sponsored (coucou la DGSE) but that's about it citizenlab.ca/2015/03/morg...

@dirkjanm.io Do you have any Europe-based training planned in the coming months? (besides the Insomnihack one I will unfortunately be unable to attend - such a shame as I live in Lausanne)

📢 Christophe Tafani-Dereeper will present "Code to Cloud: Exploiting Modern Web Applications to Breach Cloud Environments" at Insomni’hack 2025! 📖 Check the full lineup and get your ticket: insomnihack.ch/talks/code-t... #INSO25 #Cybersecurity #EthicalHacking #Switzerland

Device code phishing strikes again www.volexity.com/blog/2025/02...

Outstanding research by my awesome colleague @sethsec.bsky.social, along with an open-source to scan for suspicious AMIs in your own AWS account securitylabs.datadoghq.com/articles/who... github.com/DataDog/whoA...

DeepSeek mania is driving the AI world crazy. Is the bubble popping? are we now slaves to Chinese AI? is Nvidia over? don't think so, no, and probably not www.404media.co/deepseek-man...